TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses - @tanstack/react-start

Description

An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker’s JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority.

Recommendation

Update the @tanstack/react-start package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.143.12, < 1.168.60
• Patched version(s): 1.168.60

References

• GHSA-qx66-fv34-fjm8
• CVE-2026-102989
• CWE-79
• CAPEC-310